SSL VPN using Azure MFA with SAML SSO not working

Question

Hello,we have been experiencing issues with ssl vpn access from MacOs devices using forticlient 7.0.The vpn uses Azure MFA with SAML SSO authentication. The user can access the vpn via web browser but it's not a practical solution.When accessing using forticlient the following error is displayed "The response from https://vpn.xx.xx:4443 was invalid".From the Fortigate logs we have extracted the following error: "sslConnGotoNextState:301 error (last state: 1, closeOp: 0)" We've researched the issue and found that fortitray had to be enabled or else vpn would not work, even this didn't resolve our issue. We're aware of certain known issues for this vpn configuration specific for the forticlient macos releases:https://docs.fortinet.com/document/forticlient/7.0.0/macos-release-notes/124818/known-issues We' would like to know if it's possible to determine which of these bugs is related and if there's any workaround to apply until fortinet resolves it. Any suggestion on the matter would be appreciated. Thank youPeter

Debbie_FTNT · Answer

Hey Peter

Is the issue macOS specific, so Windows/other OS FortiClients are unaffected? What about web-mode SSLVPN, does that work?

-> would help us narrow down if this is a general VPN issue, or if it is specifically a FortiClient/macOS issue

If you have a ticket with FortiGate support to investigate from that side, you should be able to ask if it is possible to get an earlier version of FortiCient to verify if the issue is with the specific FortiClient version.

As for the known issues you listed, these two could almost certainly cause the issue you outlined:

678564: FortiClient (macOS) does not honor remoteauthtimeout or login-timeout from FortiGate with SAML authentication.
-> remoteauthtimeout in particular; this is how long the FortiGate waits for a response from the remote auth server (in this case SAML IdP) before discarding the authentication, and in SAML MFA in particular, the entire login process can take a minute or so. Default value on the FortiGate is 5 seconds; I am not sure what value macOS FortiClient would enforce when ignoring remoteauthtimeout

684913: SAML authentication on SSL VPN with realms does not work

If you have SSLVPN realms (login at realm.<vpn>:<port> or <vpn>:<port>/<realm>), you might want to consider a test setup without realms to see if that resolves your issue.

Sign up

Login with SSO

Login to the community

Login with SSO